This advisory covers six distinct vulnerabilities in Red Hat Satellite 6.18 prior to version 6.18.7: CVE-2026-5135 (broken access control allowing unauthorized host configuration modification), CVE-2026-5136 (privilege escalation via usergroup role assignment manipulation), CVE-2026-5138 (information disclosure through improper validation of nested request parameters), CVE-2026-5142 (cross-tenant private SSH key disclosure via taxonomy scoping bypass), CVE-2026-32282 (root.Chmod following symlinks outside root), and CVE-2026-40192 (denial of service via decompression bomb in FITS image processing in python-pillow). These vulnerabilities affect components including Foreman, yggdrasil-worker-forwarder, and python-pillow within Red Hat Satellite 6.18 for RHEL 9. The advisory provides a security update in version 6.18.7 that addresses these issues.

The vulnerabilities collectively allow unauthorized modification of host configurations, privilege escalation to administrator-level access, information disclosure including cross-tenant private SSH keys, potential filesystem manipulation via symlink traversal, and denial of service conditions. These impacts could compromise system integrity, confidentiality, and availability of Red Hat Satellite environments prior to version 6.18.7.

A security update to Red Hat Satellite 6.18.7 is available that addresses all listed vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the Red Hat Satellite documentation. No alternative mitigations or workarounds are specified in the vendor advisory.